The Agent Skills Directory

[PROMPT_INJECTION]: Indirect Prompt Injection Surface
Ingestion points: The skill instructions in SKILL.md (Workflow Step 1.2) explicitly direct the agent to read the complete body and comments of user-supplied files, issues, URLs, and wiki articles.
Boundary markers: The instructions do not define boundary markers or delimiters to isolate untrusted external content from the agent's internal reasoning.
Capability inventory: The skill possesses the capability to create directories (docs/tasks/), write multiple Markdown files, and modify the project's .gitignore file (Workflow Step 5.2).
Sanitization: There are no instructions to sanitize, escape, or validate the content retrieved from external sources before it is used to generate the implementation backlog.
[DATA_EXFILTRATION]: Network Operations and File Access
The skill is configured to fetch data from remote sources (URLs and issue trackers) and process it locally.
It interacts with the local file system to organize project tasks.
Mitigation: The skill demonstrates security awareness by instructing the agent to add the task directory to .gitignore automatically, which prevents the accidental commitment of task-related metadata or sensitive planning details to public repositories.

to-tasks